Compliance Standards We Support

The CCPA and CPRA give California residents enforceable rights over their personal information. They apply to for-profit businesses that meet revenue or data-volume thresholds - including companies outside California - and they require working security controls, documented data practices, and consumer rights workflows, not just a privacy policy.

The GDPR is the European Union regulation protecting the personal data of individuals in the EU. It applies to organizations anywhere in the world that offer goods or services to people in the EU or monitor their behavior - and it requires security appropriate to the risk, breach notification, and enforceable individual rights.

PIPEDA is Canada's federal privacy law governing how private-sector organizations handle personal information in commercial activity. It applies to Canadian businesses and can reach foreign companies whose handling of Canadians' data has a real and substantial connection to Canada - and it requires safeguards proportional to data sensitivity, mandatory breach reporting, and answers to access requests within 30 days.

CBPR is a voluntary, certifiable privacy framework for transferring personal data across borders in the Asia-Pacific region. It applies to organizations moving customer, user, or employee data between participating economies - nine jurisdictions including the U.S., Canada, and Japan - and since June 2025 it operates alongside the successor Global CBPR System.

BIPA is Illinois's biometric privacy law governing how private entities collect, use, store, share, and destroy biometric identifiers like fingerprints and face geometry. It lets individuals sue directly for $1,000 to $5,000 per violation - which is why biometric timeclocks and facial recognition systems make businesses of every size frequent defendants.

COPPA is the U.S. federal law protecting the personal information of children under 13 online. It applies to child-directed websites and apps, and to any operator that knowingly collects children's data - including third-party tools embedded in those services - and the 2025 amended Rule requires a written security program, retention limits, and separate consent before sharing children's data.

ISO/IEC 27701:2025 is the international standard for a Privacy Information Management System (PIMS) - a standalone, certifiable framework for governing personally identifiable information across its lifecycle. It applies to controllers and processors of any size, and it can run on its own or integrate with an existing ISO 27001 ISMS.

FERPA (Family Educational Rights and Privacy Act) is the U.S. federal law protecting student education records. It binds educational agencies and institutions that receive U.S. Department of Education funds - and reaches their vendors as "school officials" under institutional control. In practice, FERPA compliance lives in IT: access controls, cloud platforms, and vendor oversight.

HIPAA protects the privacy and security of health information. It applies to healthcare providers, health plans, clearinghouses, and every business associate that creates, receives, maintains, or transmits protected health information on their behalf — and it requires administrative, physical, and technical safeguards from your IT.

HITECH strengthens HIPAA. Enacted in 2009, it raised penalties, extended direct liability to business associates, and expanded breach notification for electronic health information. If your organization handles ePHI - as a provider, vendor, or service provider - HITECH applies to you.

HITRUST CSF is a certifiable security framework that harmonizes dozens of regulations and standards - HIPAA, NIST, ISO, PCI DSS - into one control set. It is most common in healthcare, where customers, payers, and partners often require certification as proof of security maturity.

The ONC Health IT Certification Program certifies that EHR technology meets federal standards for security, privacy, and interoperability. Certification proves the software is capable - the organizations using it remain responsible for configuring and operating it securely.

42 CFR Part 2 protects the confidentiality of substance use disorder treatment records. It applies to federally assisted programs that provide SUD diagnosis, treatment, or referral - and to everyone who receives their records. Since the 2024 final rule, it aligns with HIPAA on consent, breach notification, and penalties, while staying stricter on use of records against patients.

EPCS is the set of DEA requirements (21 CFR Part 1311) governing how controlled substance prescriptions are issued, signed, and transmitted electronically. It applies to prescribers, pharmacies, and the technology providers supporting them - and unlike HIPAA, it names specific required controls.

The Gramm-Leach-Bliley Act (GLBA) is the U.S. federal law that requires financial institutions to protect customers' nonpublic personal information. It reaches far beyond banks - mortgage brokers, tax preparers, financial advisors, and fintech platforms all qualify - and its security requirements are enforced through the FTC Safeguards Rule.

The FTC Safeguards Rule (16 CFR Part 314) is the regulation under GLBA that defines the written information security program financial institutions must maintain. It applies to FTC-regulated businesses many owners never think of as financial - auto dealers offering financing, tax preparers, mortgage brokers - and it names specific controls: a Qualified Individual, MFA, encryption, testing, and FTC breach notification.

The Federal Financial Institutions Examination Council (FFIEC) is the U.S. interagency body - the Federal Reserve, FDIC, NCUA, OCC, CFPB, and the State Liaison Committee - that sets uniform examination standards for financial institutions. FFIEC does not examine anyone itself; its guidance defines what your regulators test, especially on cybersecurity, third-party risk, and technology governance.

The Financial Industry Regulatory Authority (FINRA) is the self-regulatory organization that oversees broker-dealers and securities firms in the United States. Its rules are mandatory and enforceable, and its exams focus heavily on cybersecurity, supervision (Rule 3110), recordkeeping (Rule 4511), SEC Regulation S-P compliance, and third-party risk.

NYDFS 23 NYCRR 500 is New York's cybersecurity regulation for banks, insurers, and financial services companies licensed by the Department of Financial Services. It is one of the most prescriptive cyber regulations in the country: named controls, a designated CISO, 72-hour incident reporting, extortion-payment reporting, and an annual compliance certification signed by your highest-ranking executive and CISO.

The Sarbanes-Oxley Act (SOX) is the U.S. federal law that protects investors by requiring accurate, reliable financial reporting from public companies. Though written for finance, SOX compliance runs on IT: access controls, change management, and audit trails over every system that touches the numbers - including systems run by your vendors.

Nacha (formerly the National Automated Clearing House Association) governs the ACH Network - the system behind payroll, direct deposit, vendor payments, and recurring billing. Its Operating Rules bind every Network participant, and new fraud-monitoring rules, fully in force since June 2026, now require risk-based monitoring from originators and receiving institutions alike.

SOC 1 is an independent examination report, performed by a CPA under AICPA standards, on a service organization's controls relevant to its customers' internal control over financial reporting. If your service touches customers' payroll, billing, transactions, or revenue data, their auditors will ask for it - SOC 1 is the language they speak.

PCI DSS (Payment Card Industry Data Security Standard) is the global security standard for protecting credit and debit card data. It applies to every organization that stores, processes, or transmits cardholder data, regardless of size - enforced through merchant agreements by the payment card brands, not by law.

PCI P2PE (Point-to-Point Encryption) is a PCI security standard for card-present payments: card data is encrypted the instant it is captured at the terminal and stays encrypted until it reaches the solution provider's validated secure decryption environment. Implemented correctly, it removes most merchant systems from PCI DSS scope.

CMMC is the Department of Defense program that verifies contractors protect Federal Contract Information and Controlled Unclassified Information. It applies to every organization in the DoD supply chain that handles covered information, at any size. Phase II third-party certification is suspended as of July 2026; self-assessment requirements remain in force.

DFARS is the Department of Defense supplement to the Federal Acquisition Regulation - the contract clauses that carry cybersecurity obligations into defense contracts. Its cyber clauses require NIST SP 800-171 protection of Controlled Unclassified Information, 72-hour incident reporting, and assessment scores in SPRS, for contractors and subcontractors of any size.

ITAR is the State Department regulation controlling the export of defense articles, defense services, and technical data on the United States Munitions List. It applies to manufacturers, exporters, and service providers handling that data - including manufacturers who never export, who are still required to register with DDTC.

The Controlled Unclassified Information (CUI) Program is the government-wide framework standardizing how sensitive but unclassified information is identified, marked, and protected. It binds federal agencies directly and reaches contractors through contract clauses - it is the foundation NIST SP 800-171, DFARS, and CMMC are built on.

NIST SP 800-53 is the federal government's catalog of security and privacy controls - currently Revision 5, organized into 20 control families. Federal agencies and their contractors use it directly; much of the private sector encounters it as the reference definition of reasonable security in vendor reviews and questionnaires.

FISMA is the Federal Information Security Modernization Act of 2014 (P.L. 113-283), the law requiring federal agencies - and contractors operating systems on their behalf - to manage cybersecurity risk in a structured, documented way, using NIST standards as the playbook.

FedRAMP is the Federal Risk and Authorization Management Program - the U.S. government's standardized process for authorizing cloud services used by federal agencies, codified at 44 U.S.C. 3607-3616 and administered by GSA. If your cloud product stores, processes, or transmits federal information, FedRAMP applies.

The CJIS Security Policy is the FBI's mandatory security baseline for criminal justice information - currently version 6.1 (June 2026). It applies to law enforcement agencies, government entities, and every vendor or contractor whose staff can access CJI, and it weighs personnel trust as heavily as technology.

NERC CIP is the set of mandatory, penalty-backed cybersecurity standards protecting the Bulk Electric System, the generation and transmission backbone of the North American grid. It directly binds NERC-registered entities. Vendors and MSPs are not regulated directly - they inherit CIP-grade requirements contractually through their utility customers.

ISA/IEC 62443 is the global standard series for securing industrial automation and control systems (ICS/OT). It applies to asset owners who operate industrial systems, the integrators and service providers who build and maintain them, and the suppliers whose products run them.

COBIT is ISACA's framework for governance and management of enterprise IT. It gives executive teams, boards, and IT leadership a structure for owning technology decisions, aligning IT and security with business goals, and proving both work. The current version is COBIT 2019.

The NIST Cybersecurity Framework (CSF) is a voluntary risk management framework for understanding, managing, and communicating cybersecurity risk. CSF 2.0, published February 26, 2024, organizes cybersecurity into six Functions - Govern, Identify, Protect, Detect, Respond, Recover - and applies to organizations of every size and sector, not just critical infrastructure.

ISO/IEC 27001 is the international standard for building and maintaining an Information Security Management System (ISMS) - how an organization runs security, not just which tools it deploys. It applies to organizations of any size or sector, and matters most to companies selling to enterprise or global customers who ask for certification or alignment. The current edition is ISO/IEC 27001:2022.

SOC 2 (System and Organization Controls) is an AICPA reporting framework that evaluates how well an organization protects customer data and operates its systems securely over time. It applies to SaaS and service companies that handle customer data, and it has become the default trust requirement in B2B sales and procurement.